[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5717ED34.8020303@bestmx.net>
Date: Wed, 20 Apr 2016 22:57:24 +0200
From: "e@...tmx.net" <e@...tmx.net>
To: passwords@...ts.openwall.com
Subject: Re: Mandatory password changes - DIEDIEDIE!
> The statement will simply be something like "stop changing passwords
> frequently".
+1
> We can no longer require users to have long & complex passwords, unique
> to every service & site, and additionally ask them to change them every
> 30-60-90 days.
it is important to separate all these 4 points.
1. WE CAN AND SHOULD REQUIRE users to have LONG passwords,
2. we can not say anything about "complex" because we do not know what
is complex and if it is relevant to our problem.
3. uniqueness is a delicate issue, it is sufficient for a very small
portion of your passwords to be unique. moreover it is good to have a
single shitty passwords for forums and similar cesspools
4. compulsory expiration is a separate issue,
which is bad, but can be mitigated by writing passwords on paper.
> It create more problems than it solves, it is annoying,
> counterproductive and may result in users deliberately break security
> policies in order to get their work done.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
